Pennit

Pennit is a mobile receipt scanner and expense tracker for online sellers. This page explains, in plain language, what data the app collects, why, and who we share it with. If anything here is unclear, email devfaraji@gmail.com.

1. Who we are

Pennit (the "app") is operated by an independent developer. The app is distributed through the Google Play Store. The publisher contact email is devfaraji@gmail.com.

2. What we collect

We collect the following, and only the following:

• Account info from Google Sign-In — your email address and display name, used to create your account and let you sign in. We do not receive your Google password.
• Receipt photos — the photos you take in the app. They are uploaded to secure storage and used solely to extract receipt details (vendor, amount, date, category).
• Receipt data — the vendor, amount, date, category, and Schedule C line extracted from each receipt, plus any notes or category changes you make.
• Subscription state — whether you have an active Pennit subscription, and which plan. Payment is handled by Google Play; we never see your card details.

We do not collect: your contacts, your location, your microphone audio, files outside the app, your other apps' data, advertising identifiers, or any analytics about how you use individual screens.

3. Permissions we request

• Camera — to capture receipt photos. The camera is only used while you are on the scan screen and only when you tap the shutter.
• Internet — to upload receipts and sync your data across devices.

We do not request microphone, location, contacts, files/media access, or background access. If a future version requests a new permission, this page will be updated before that version ships.

4. Who we share data with

We use a small number of trusted vendors to operate the app. We share only what each vendor needs to do its job.

• Supabase (database and file storage hosting) — stores your account, receipts, and receipt photos. Data is encrypted in transit and at rest. See supabase.com/privacy.
• OpenAI (receipt understanding) — when you scan a receipt, the photo is sent to OpenAI's GPT-4o-mini API to read the vendor, amount, date, and suggest a category. Per OpenAI's API terms, your data is not used to train their models. See openai.com/policies/privacy-policy and API data usage.
• Google (sign-in and payments) — Google Sign-In handles authentication; Google Play handles your subscription billing. See policies.google.com/privacy.
• RevenueCat (subscription state, when subscriptions launch) — receives your anonymized user ID and subscription status so we can unlock paid features on your devices. See revenuecat.com/privacy.

We do not sell your data, share it with advertisers, or share it with data brokers. We only disclose data when legally required (a valid subpoena or court order) and we will notify you when permitted by law.

5. How long we keep it

• Account data — kept while your account exists. If you delete your account, we delete it within 30 days.
• Receipts and photos — kept until you delete them in the app, or until you delete your account.
• Photos sent to OpenAI — OpenAI may retain API request logs for up to 30 days for abuse monitoring, then deletes them. They are not retained beyond that and are not used for training.

6. Deleting your account and data

You can delete any individual receipt from the receipt detail screen. To delete your entire account and all associated data, email devfaraji@gmail.com from the address you signed up with. We will delete your account, receipts, and photos within 30 days and confirm by email when done.

7. Children

Pennit is intended for adult business owners. We do not knowingly collect data from anyone under 13. If you believe a child has used the app, contact us and we will delete the account.

8. Security

Data is encrypted in transit (HTTPS) and at rest. Authentication uses Google Sign-In; we do not handle passwords. Receipt photos are accessible only to you, via short-lived signed URLs.

9. Changes to this policy

When we make material changes (new permissions, new vendors, new categories of data), we update the "Last updated" date and may notify you in-app the next time you open it.

10. Contact

Questions, requests, or complaints: devfaraji@gmail.com.